uuid 2 IDOR in Password Reset API Leads to Administrator Account Takeover | TheForms Jun 8, 2026 UUID-Based IDOR Through Member API | Apex May 9, 2026